Async MEV-resistant liquidation module

This page is a work-in-progress documentation page. For any questions not covered by the docs, please feel free to reach out to the community on Telegram or Discord.

Problem

The liquidation mechanism is a crucial part of any lending protocol, in general, and CDP-based stablecoins, in particular. At the time of writing (Q1 2023), the largest liquidation market is the one created by the Aave lending protocol. As the market leader, Aave has a battle-tested and robust liquidation mechanism that uses "fixed spread liquidations." While the mechanism itself works reliably, it is not very capital efficient and, in the case of StableUnit, can be reliably optimized, giving up to two orders of magnitude cheaper liquidations.

For CDP-based stablecoin, a user can use the lending module to borrow Stable Units (e.g: USDPro, EURO-Pro, etc.) and pledge some asset as a collateral, for example, stETH. The exchange module must be able to liquidate the position, as soon as possible, if the price of collateral gets to a certain threshold.

At the same time, the protocol harvests profit in the profit module in different assets, and wants to exchange it to Stable Units (such as USDPro) without any haste for distribution among users.

Proposed solution

• The trader bot monitors positions that can be liquidated. The lending module closes the position through the trader bot and creates an order to exchange the collateral in the exchange module.

• The exchange module has a whitelist of stablecoins that can be used to exchange the collateral.

• The price of the order has a discount that gets bigger per block to motivate the trader bot to exchange the collateral for stablecoins as soon as possible.

• The exchange module (smart pools from Balancer can be used in the future) exchanges the accumulated amount of stablecoins to USDPro without any haste and with a very small discount.

• The exchange module repays the debts of liquidating positions by burning USDPro and sends the profit amount in USDPro to the contract of profit distribution.

Overall algorithms

The trader bot monitors positions that can be liquidated by SuManager.isLiquidateble().

If the position can be liquidated, the trader bot executes SuManager.triggerLiquidate(). It withdraws the collateral from the position to the exchange module, increases the balance of USDPro which needs to be burned in the exchange module, creates the order to sell the collateral, and closes the position in the lending module completely.

The trader bots can fill the order by paying using stablecoins from the whitelist.

The order is created with a callback. When the order has been filled, the StableUnitBuyBack.updateAuction() will be executed.

The StableUnitBuyBack contract accumulates stablecoins from the whitelist. It is able to exchange stablecoins to USDPro following the method StableUnitBuyBack.buyToken(). When the trader bot buys tokens with USDPro, the contract burns USDPro as debt repayment of liquidated positions. If all debt is repaid, the contract sends USDPro as profit to the profit distribution contract.

Step-by-step explanation

Step 1: Staking

To participate in liquidations on the Stable Unit protocol, a prospective liquidator should stake the SuDAO ERC20 tokens for a period of time. The more tokens and the longer the time staked, the more VotingPower one receives, similarly to the veCRV model.

The staking smart contract supports an indexed ordered set of potential liquidators, allowing the top 21 stakers with the highest VotingPower to participate in the liquidation process.

Step 2: Trigger Liquidation

Bot #1, which anyone can fork, monitors all CDPs via the GraphQL model. It estimates the health factor and checks the top candidates for liquidation.

When liquidation is possible, the bot calls the trigger liquidation function that removes the CDP, sends the collateral to the liquidation contract to market sell it, and adds the outstanding debt to the total liquidation debt.

The callers who successfully trigger a liquidation receive a percentage (default 0.1%) of the collateral. The percentage varies based on the size of collateral and asset and is set up by the StableUnit DAO.

Step 3: Market Sale of the Collateral

Bot #2 is used to sell the collateral and complete the liquidation. During creation, each CDP is assigned a unique ID that deterministically corresponds to a number ∈ [0..21) by applying modulo 21 operation (variable, set up by DAO).

When a liquidation is triggered, the liquidator with the CDP's number has 60 seconds (default value of the StableUnit configuration that can be changed by the DAO) to sell the collateral.

During this initial sale period, no other liquidator has the right to buy the collateral. In that way, there is no competition, and 60 seconds are long enough to make a potential MEV attack economically unreasonable.

When the initial time is over, and the market order is not filled by the assigned liquidator, anyone among stakers can fill the order. The original assignee is removed from the list while also subtracting 10% (variable set by DAO) of their voting power existing at the current moment for the staking time period.

Note that no SuDAO tokens are ever lost, and, they can be unstaked when the period is over.

If the same liquidator who missed his assigned liquidation’s initial period wants to participate again before staking is over, they need to stake more tokens on different wallets.

Step 4: Exchange USDC/USDT for StableUnits -

Liquidations are done using the most optimal/liquid pair, which will probably not be a USDPro pair (e.g: ETH/USDC) but since stablecoins are expected to have a stable value (unless depegging), other stablecoins should be tradable against USDPro.

Once a position is liquidated using other stablecoins such as USDC and USDT. The protocol is in no rush to exchange them for USDPro. But at the same time, there might be a need for deeper liquidity between USDPro and these stablecoins.

The protocol will be able to use these stablecoins to provide liquidity for USDPro and have them as protocol-controlled value.

Step 5: Repay the Debt

Once the liquidity pool is deployed, users will be able to exchange their USDPro for other stablecoins such as USDC, and USDT.

By doing so, they are giving back the USDPro generated by the protocol.

The protocol burns it to complete the repayment of the debt and close the position.

Infrastructure

To run both trigger and liquidation bots, stakers aren't required to have high computation power, or liquidation funds, beyond minimum amount of gas token to pay for transaction itself.

By default, the bot uses AAVE's Flashloans, and one of 3 routers for arbitrage consideration: 1inch, paraswap or Uniswap.

Arbitrageurs who staked SuDAO aren't limited to the reference implementation of the bot, and are free to choose any implementation themselves.

Risks & Mitigation

While this mechanism is able to provide liquidation via a market sell order to achieve higher capital efficiency, there might be edge cases where a market sale might not be the optimal strategy. The obvious one is a cascade liquidation, where the sell-off of the collateral is large enough to lower the price of the asset so deep that it triggers other liquidations and leads to a "chain reaction" of market sales or cascades. In this case, the priority for the lending protocol is to sell the collateral ASAP before the price of the collateral drops lower than the outstanding liability, and selling it will lead to a net loss for the protocol.

To achieve that, we have to prioritize the selling time over the price. However, based on previous on-chain data, one minute is a sufficiently long time to be able to distinguish between an ordinary situation of liquidation and a severe market crash. A detailed quantitative calculation of the exact risks and losses is a WIP task.

Efficiency analysis

Since in the Stable Unit protocol, liquidations are done through market sales, existing on-chain data can be used to approximate the typical collateral loss during this process.

Based on 1inch data (WIP), a market sale of 130ETH is subject to 0.2% slippage. This is the average loss when selling the collateral. In comparison, Aave’s guaranteed fixed spread liquidations incur a loss of 7%.

Considering costs, this is a massive increase in cost efficiency when handling liquidations.

Interfaces

interface IExchangeASAP {
    struct Order {
        address assetToken;
        uint256 amountLeft;
        address exchangeToken;
        address exchangeAmount;
        address beneficiary;
        uint256 blockNumber;
        bytes callback;
    }

    Order[] public orders;

    function addOrder(address assetToken, uint256 amount, address exchangeToken, address beneficiary, bytes callback) external;
    function fillOrder(uint256 orderId, address inToken, uint256 inAmount, uint256 outAmount) external;
}

interface IStableUnitBuyBack {
    struct Auction {
        uint256 startBlockNumber;
        uint256 initialPrice;
    }

    uint256 public suUsdAmountToBurn;

    // asset => auction
    mapping(address => Auction) public auctions;

    function addBurnBalance(uint256 suUsdAmount) external;
    function buyToken(address token, uint256 tokenAmount, uint256 suUsdAmount) external;
    function updateAuction(address token) public;
}

interface ISuManager {
    /// @notice view function to check if position is liquidatable
    function isLiquidatablePosition(address asset, address owner) public view returns (bool);
    function triggerLiquidation(uint256 cdpId) external;
    function closePosition(uint256 cdpId, uint256 suUsdAmount) exter

Liquidation module diagram

Lending module diagram

Lending module structure

Liquidation bot diagram

Liquidation process diagram

References

Github

https://github.com/StableUnit/stableunit-poc-v2/tree/master/contracts/liquidator

Liquidation system design part 1

https://medium.com/stableunit/stable-unit-liquidation-system-design-1b3534b2033e

Liquidation system design part 2

https://medium.com/stableunit/liquidation-modules-overview-code-comparing-578c98657978